phase 10: but what if the person knows already the url - then they can hack in?; but before that, lets fix the template problem. login.php looks terrible. create header.php, footer.php - use it in index.php, login.php, and some random-file.php; fix css on login page